External or in-house DPO? Costs, the requirements of Articles 37-39 GDPR and when designation is mandatory

The data protection officer is one of the few functions the GDPR describes explicitly - including when you must fill it, what that person is supposed to do and what you are not allowed to make them do. The “employee or outsourcing” question is secondary to the first one: are you obliged to designate a DPO at all?

When is designating a DPO mandatory? (Article 37(1) GDPR)

The obligation covers three situations:

• A public authority or body - except courts acting in their judicial capacity. No debate here.
• Core activities consisting of processing operations which require regular and systematic monitoring of individuals on a large scale - e.g. platforms tracking user behaviour, telematics, loyalty programmes, adtech, scoring.
• Core activities consisting of large-scale processing of special categories of data (Article 9) or data relating to criminal convictions (Article 10) - e.g. healthcare providers, laboratories, parts of the insurance and HR-tech sectors.

The key concepts - “core activities”, “large scale”, “regular and systematic monitoring” - have no hard numerical thresholds. They are interpreted in line with the Article 29 Working Party guidelines (WP243, endorsed by the European Data Protection Board, EDPB). In practice: if data processing is the heart of your business model, and not just HR administration and invoicing, assume you are close to the obligation.

Two things people forget:

• If you are not obliged to, but designate a DPO voluntarily, all the requirements of Articles 37-39 apply exactly as if the designation were mandatory.
• The designation of a DPO must be notified to the President of UODO (the Polish data protection authority; in Poland, within 14 days), and the DPO’s contact details must be published.

What the GDPR requires of the function (Articles 38-39)

Whatever the employment model:

• Independence - the DPO may not receive instructions regarding the exercise of their tasks, may not be penalised or dismissed for performing them, and reports to the highest level of management.
• No conflict of interest - the DPO may perform other roles, but not ones in which they themselves determine the purposes and means of processing. In practice this rules out, among others, the head of IT, the head of HR and members of the management board. This is the most common mistake in the in-house model. The Polish DPA (UODO) enforces this in practice: a PLN 978,000 fine for Poczta Polska, whose DPO held a managerial post and other duties (decision of 26 January 2026), PLN 261,918 for Toyota Bank Polska, whose DPO reported to a director rather than the management board (decision of 20 January 2025), and PLN 12,000 for a court bailiff who had acted as DPO of his own office for five years (decision of 31 August 2026).
• Adequate resources and access - to processing operations, to data, to training.
• Tasks (Article 39) - informing and advising, monitoring compliance with the GDPR, supporting DPIAs, cooperating with UODO, acting as a contact point.

When does the in-house DPO model make sense?

Advantages: day-to-day presence in the organisation, in-depth knowledge of its processes, immediate availability. For large organisations with complex processing (a bank, a hospital, a telecoms operator), a full-time DPO - often with a team - is the natural choice.

Costs and risks:

• The full cost of employing a specialist with combined legal and technical skills - realistically a dozen or so thousand PLN a month gross, including employer on-costs, plus training and holiday cover.
• The risk of a conflict of interest when roles are combined (“our lawyer will also be the DPO” - usually defensible; “our head of IT will also be the DPO” - usually not).
• A single point of failure: one person, one perspective, one notice of termination away from losing continuity of the function.

When does the external DPO model make sense?

The GDPR expressly allows the DPO role to be performed on the basis of a service contract (Article 37(6)). Formally nothing changes: the controller designates the DPO, notifies UODO and publishes the contact details.

Advantages:

• The cost is usually considerably lower than a full-time hire - market subscriptions for SMEs start at a few thousand PLN a month.
• Access to experience from many organisations and sectors - an external DPO has already seen your problem somewhere else.
• Natural independence - it is easier to avoid a conflict of interest when the DPO is not woven into internal structures.
• Continuity of the function does not hinge on a single recruitment.

Limitations: less day-to-day presence (this has to be designed into the contract: response SLAs, regular visits, involvement in projects) and the need for proper onboarding, so that the external DPO genuinely knows the organisation rather than just signing documents.

How to choose - three check questions

1. Scale and complexity of processing: do you need someone full-time, or for a dozen or so hours a month? For most SMEs - the latter.
2. Do you have someone in-house with no conflict of interest and genuine legal and technical skills? If not, the external model is safer than appointing whoever happens to be to hand.
3. Total budget: compare the cost of a full-time hire including on-costs, training and cover - not just the salary - with an external subscription.

This article is for information purposes only and does not constitute legal advice.